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Abstract 

C"| | Quantum information studies how information is encoded and decoded in quantum me- 

Qh chanical systems. In this paper, we study the basic scenario where two classical bits are en- 

coded into a quantum state. We prove a "learning lemma," which provides a new upper bound 
on the average probability of decoding each bit that depends on the probability of learning the 
XOR of the two bits. Moreover, we give bounds on how well each bit can be decoded when 
qh. their XOR is hidden and generalize these concepts to strings. 

Our learning lemmata have strong connections to cryptography and nonlocality. In partic- 
ular, we show a set of equivalences between secure oblivious transfer protocols, CHSH-type 
^ | games, and quantum encodings hiding the XOR. These equivalences allow us to use results in 

(*f) • one area to prove results in another. For example, we use information bounds to give bounds 

on the values of CHSH-type games and also on the "correctness" of certain secure oblivious 
ON . transfer protocols. We also use results of quantum XOR games to show that secure oblivious 

transfer admits perfect parallel repetition. Last, our learning lemmata enable us to improve the 
lower bounds on the cheating probabilities of any quantum oblivious transfer protocol. 

o 






1 Introduction 



Quantum information studies how information is encoded and decoded in quantum mechanical 
systems. There are many examples where encoding information in quantum states can be much 
more efficient than classical ones. For example, one can use the fact that an n-dimensional quantum 
system has an exponential description in order to "encode" 2 n classical bits in it, for example in 
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a quantum fingerprint state HBCWdWOli However, quantum information does not always offer 
some advantage, since the uncertainty principle postulates that every time an external observer 
measures a quantum system, the state of the system collapses after the measurement and some 
information may become irretrievable. This intricate interplay between these two properties has 
been at the basis of some of the most fundamental results in quantum information, from quantum 
encodings, to non-locality, and to quantum cryptography. 

Our goal is to study the relation between these areas and provide new insight on the power and 
limitations of quantum information, by looking at it through these various lenses. After describing 
in more detail the different concepts that we study, we prove some precise quantitative equivalences 
between them and provide a number of applications. 

1.1 Quantum encodings and learning the XOR 

One of the fundamental results in quantum information is Holevo's theorem HHoi731 which, in 
high level, says that if one wants to transmit classical information, then encoding the classical 
information into quantum bits is no more efficient than encoding it into classical bits. In other 
words, classical information cannot be compressed using quantum information. The same negative 
result holds for the weaker task that is referred to as Random Access Codes. Here, one is looking 
for an encoding of n classical bits into a quantum state, where each bit can be decoded with high 
probability from a single copy of the encoding (but not necessarily all of them at the same time). 



Again, quantum encodings are no more efficient than classical ones |Nay99 1. 

However, the extraordinary power of quantum information has been proven in a variety of mod- 
els: for example, in communication complexity, there is a number of distributed tasks, where quan- 
tum encodings are exponentially more efficient than classical ones MBCWdW01[|BJK04llGKK + 08l 
IRK11H . Moreover, it is possible to encode two classical bits in one quantum bit such that either bit 
can be correctly decoded with probability cos 2 (vr/8), see IBBBW831IANTV99I1 . 

Let us focus on the following simple scenario: The quantum state p Xo ,x 1 encodes two classi- 
cal bits xq and x\ that are drawn from some known distribution. Imagine there exists a decoding 
procedure (i.e. a quantum measurement) to decode xq that provides the correct answer with prob- 
ability po an d a different decoding procedure that decodes x\ with probability p\. We would like 
to analyse the average decoding probability, i.e. the quantity (pq + pi)/2. 

One way to bound this quantity is through entropic uncertainty relations, which can provide 
upper bounds on this probability that depend on the decoding procedures but not on the encoding 
(see for example MOWlOll ). For example, if the first decoding procedure is a measurement in the 
computational basis and the second in the Hadamard basis, it is easy to see that no matter what 
quantum encoding we use, there is always some entropy in the distribution of outcomes of these 
two measurements. This, in turn, implies that the average decoding probability cannot be 1. 

Here, we study the average decoding probability by relating it to the probability of decoding 
some other function f(xo, x\) of the bits, for example the one that outputs both bits or their XOR. 
Classically, it is straightforward to relate the probability of decoding f(xo, x\) to the probabilities 
of decoding each bit x.j. If one has some partial information about (xq, xi) then it is easy to find 



the optimal guess for (x$,xi). However, the situation is more delicate in the quantum world. 
Suppose we try to determine f(xo,x\) by decoding each bit x.j. Once the first bit is decoded, 
the encoding collapses to some eigenstate of the decoding operator, hence the probability of then 
correctly decoding the second bit may have changed. In other words, getting information about xo 
could destroy the information about x\. 

We provide new upper bounds on the average decoding probability of two classical bits that 
depend on the probability of correctly decoding both bits or the XOR of the two bits. We also 
extend these results to strings and discuss their relation to complementarity. 

Theorem 1 (XOR learning lemmata) Let {p Xo ,x 1 '■ xo, xi} be a quantum encoding of two classi- 
cal bits (or bit strings) xq, x\ drawn from some known probability distribution. Denote the average 
decoding probability of x^ and x\ by c:=\ Pr[learning xq] + ^ Pr[learning x±\. Then 

1. Prflearning xo © x\] > (2c — l) 2 when xo, x\ G {0, 1}, 

2. Prflearning x © xi] > c(2c - l) 2 , if c > 1/2, when x , xi G {0, l} n . 

In fact, Pr[learning (xo, xi)] > c(2c — l) 2 , if c > 1/2, when xo, x\ G {0, l} n . 

The probability of learning a value is defined as the maximum over all decoding procedures of 
the probability that the output of the decoding procedure is equal to the correct value. 

As a consequence of the previous theorem, in the case where the probability of learning xo © x\ 
is exactly 1/2, i.e. the encoding reveals no information about the XOR, we have the following 
theorem. 

Theorem 2 (Hidden XOR lemmata) Let {p xo ,xi '■ ^Oj^i} be a quantum encoding of two clas- 
sical bits (or bit strings) xq, x\ drawn from some known probability distribution. If the encoding 
reveals no information about xq © x\, then 

1. ^ Prflearning xo] + \ Prflearning xi] < cos 2 (7r/8) when xo, x\ G {0, 1}, 

2. \ Prflearning xo] + \ Prflearning xi] < \ + yj t+1 when xo, xi G {0, l} n . 

In order to prove the above theorems, we study how the distribution of the measurement out- 
comes changes when we perform the two measurements sequentially on the same quantum state. 
We say that two measurements are perfectly complementary if after having performed the first 
measurement, no more information can be extracted by performing the second measurement on 
the post-measured state. On the other hand, they are non complementary if after measuring with 
one, the probabilities of the outcomes of the second are unaffected (which is the case for classical 
measurements). For example, the measurements on the computational and Hadamard bases are 
complementary while the measurements on different subsystems of a product state are non com- 
plementary. Our theorems provide a quantitive way of studying the notion of complementarity (see 
Appendix |A]). We also show how our lemmata are related to a number of fundamental properties 
of quantum information, including non-local games and quantum cryptographic primitives. 



1.2 The CHSH game 

The CHSH game is a well-known tool for studying quantum non-locality and the power of en- 
tanglement MCHSH 691. It is a game between Alice and Bob who initially share a quantum state 
and are not allowed to communicate any further. Alice receives a random x G {0, 1} and outputs 
a G {0, 1}. Bob receives a random y G {0, 1} and outputs b G {0, 1}. The value of the game, 
denoted w*(CHSH), is the maximum probability that a © b = yx, which can be proven to be 
strictly higher than the value when Alice and Bob do not initially share any quantum state. 

One can recast the CHSH game in the framework of quantum encodings and show that the value 
of the game is equal to Bob's average decoding probability depending on whether he receives y = 
or y = 1. For example, once Alice receives x and measures to learn a, the post-measured state Bob 
has is an encoding of a and x. We can thus write the value of the game as 

Pr[Bob receives y = 0]Pr[Bob outputs b = a] +Pr[Bob receives y = l]Pr[Bob outputs b = a©x] 

which can be rewritten as 

- Pr[Bob can learn a] -\ — Pr[Bob can learn a x\. 

Note also that the non-signalling condition of the CHSH game says that the probability that Bob 
can guess Alice's input is 1/2 can be equivalently stated as the fact that the maximum probability 
of correctly decoding the XOR of a and a © x (the two bits Bob wishes to learn in this case) is 1/2. 
With this perspective, we can see how the CHSH game is related to quantum encodings where the 
XOR is hidden. 

In MOW 101 . they explore this idea further by providing some close relations between special 
types of uncertainty relations and the value of the CHSH game in quantum but also more general 
theories. 

1.3 Oblivious transfer 

Oblivious transfer is a fundamental cryptographic primitive, where Alice sends to Bob one of two 
bits (xo, X\) but is oblivious to the bit Bob receives. We wish to design protocols to accomplish the 
following three (conflicting) tasks: Alice cannot learn which bit is received by Bob, Bob cannot 
leam the XORLjof Alice's two bits, Bob learns the correct value when both parties are honest. 

Let us define OT p with cheating probabilities as follows (formal definitions of all primitives 
and games used in this paper can be found in Section |2): 

• Alice outputs (zq, z\) and Bob outputs (b, w), where zo,zi,b are uniformly random bits and 
w = Zf, with probability p, 



'Note that most definitions enforce the stronger condition on cheating Bob, that he has no (or very little) information 
about Alice's other bit (instead of the XOR of her bits). However, in the classical world, if Bob cannot guess the XOR 
then he does not know one of the two bits |DFSS06|. In the quantum world, we show that this definition of cheating 
Bob relates directly to the CHSH game. 



• ^4ot is the maximum probability Alice can guess b without being caught cheating, 

• Sot is the maximum probability Bob can guess zq © z\ without being caught cheating, 

• A protocol is secure if ^4ot = -Bot = 1/2 and perfect if p = 1. 

Oblivious transfer was first introduced as a "multiplexing channel" by Wiesner MWie83ll al- 
though the cryptographic relevance was not known at the time. It was first used in a cryptographic 
sense by Rabin MRab81| as a way to share secrets. Rabin's version of oblivious transfer was not 
exactly as described above, however it was shown to be equivalent by Crepeau HCre871 . Oblivious 
transfer is a fundamental primitive because it can be used to construct arbitrary secure function 
evaluation protocols IKJ1881I . 

There are many quantum protocols for variants of oblivious transfer [BBBW83J, HDFSS0811 . 
IWST08L ISchlOl . HSikl2L HCKS13H . In particular, HBBBW83H showed a secure protocol where 
Bob gets the correct value with probability cos 2 (7r/8). On the other hand, when Bob gets the 
correct value with probability 1, then Alice or Bob can cheat with probability 58.52%, independent 
of what function of (xo,x\) Bob wishes to learn HCKS13I . 

In this paper, we are using the stand-alone definition of oblivious transfer, which does not 
guarantee composability. This makes our lower bounds on the cheating probabilities stronger, and 
in addition, this definition highlights the relations between non-locality, ciyptography, and quantum 
encodings. 

To further discuss composability, let us consider a non-interactive OT p protocol where Alice 
sends to Bob a quantum encoding and Bob can choose which bit to learn by measuring in a partic- 
ular basis. Consider using such a protocol to accomplish the following ciyptographic task, known 
as imperfect Rabin OT (the perfect version was introduced in [Rab8i]), as follows: 

• Alice and Bob use a non-interactive OT p protocol so that Bob leams Zb with probability p. 

• Alice sends to Bob a random bit c and outputs the value z c . If b = c, Bob outputs z c (with 
probability p). If b / c, he outputs #. 

We see that Bob need only delay his choice of b (and his measurement) to always learn z c with 
probability p. If Bob was forced to measure at the end of the OT p protocol, before learning c, then 
he would know z c (with probability p) only if c = b. Therefore, the protocols we consider in this 
paper, even if secure and non-interactive, are not necessarily composable. It should be clear that our 
goal is to relate this cryptographic primitive to non-local games and the notion of complementarity 
of quantum measurements, and not to construct real-life security systems. 

We now examine how the correctness is related to the security of oblivious transfer. In partic- 
ular, we answer the question of whether it is possible to sacrifice a little security for the sake of 
gaining much correctness by showing a lower bound curve relating the three quantities p, j4ot» 
and i?oT- 



Theorem 3 (Lower bound curve for imperfect oblivious transfer) For any OT p protocol, the 
correctness parameter p and cheating probabilities Aqt and -Bqt satisfy 



P<Aot( V^OT + 1 



When we set Aot = -Bot = 1/2, we get that for secure protocols p < cos 2 (7r/8), which is 
attainable by the secure protocol mentioned above in HBBBW83I . Therefore, the curve contains 
the point corresponding to the largest correctness of a secure oblivious transfer protocol. However, 
not every point on this curve is optimal. If we set p = 1, i.e., the protocol is perfect, we get that 
maxjvloT, -Bot} > 56.98%. In fact, we prove a stronger lower bound of 59.9% as well as extend 
the bound of 58.52% to oblivious string transfer, denoted OT™ which is the same as OT p , except 
Alice outputs n-bit strings instead of single bits. 

Theorem 4 (Security lower bounds on perfect oblivious transfers) In any perfect OTi proto- 
col, one party can cheat with probability at least 59.9%. Also, for any n G N and any OT" 
protocol, one party can cheat with probability at least 58.52% regardless of the function of Alice's 
two strings Bob wishes to learn. 

This shows that the security of perfect oblivious transfer cannot be amplified to get arbitrarily 
close to 50% without sacrificing some correctness. The proofs of the above two theorems are 
similar to the lower bound proof in HCKS131 and are detailed in Appendix IBl 

1.4 Equivalences between CHSH games and secure OT protocols 

The learning and hiding lemmata appear to have strong connections with non-local games as well as 
cryptographic primitives. In Section [4] we make this explicit and prove (or in some cases reprove) 
some bounds for CHSH-type games as well as variations of quantum oblivious transfer. In fact, 
we prove two equivalences, each involving three different notions: quantum information theory, 
quantum games, and quantum cryptography. The first equivalence we prove involves quantum 
encodings hiding the XOR of two strings; the primitive OT" ; and the game CHSH n , where Alice 
receives random x G {0, 1}" and outputs a G {0, l} n , Bob receives random bit y G {0, 1} and 
outputs b G {0, l} n , and they win if a» © bi = y Xi for alii G {1, . . . , n} (the XOR is bitwise 
and y Xi is scalar multiplication). Formal definitions of the games and primitives can be found in 
Section 12 

Theorem 5 (Equivalence of secure OTp and CHSH n strategies) The following four statements 
are equivalent for every n G N: 

1. There exists a set of quantum states {p xo ,xi '■ a^Oi^i £ {0,l} n } and a probability distribution 
{ftxcx! '■ xo, x\ G {0, 1}™} such that when given p xo , xl with probability n XOt xi- 
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Pr [learning xq © x-f\ = — and - Pr[learning xq\ -\ — Pr[learning xi] = p; 



2. There exists a secure, non-interactive OT™ protocol; 

3. There exists a secure OT™ protocol; 

4. There exists a strategy for CHSH„ that succeeds with probability p. 

We also prove another equivalence between quantum encodings of n pairs of bits hiding each 
XOR; OTf n , the n-fold parallel repetition of oblivious transfer; and CHSH 0n , the n-fold parallel 
repetition of CHSH. Again, p is the correctness parameter of the oblivious transfer protocol. 

Theorem 6 (Equivalence of secure OT® n and CHSH® n ) The following four statements are equiv- 
alent for every n G N: 

1. There exists a set of quantum states {p Xo ,x x '■ xo,x\ £ {0, 1} T1 } and a probability distribution 
{^x ,x! '■ xq, x\ G {0, l} n } such that when given p xo ,xi with probability ir xo>xl : 

Pr [learning xq © x{\ = — and — VJ Pr [learning x c ] = p, 

cG{0,l} n 

where x c is the string with i'th bit being the i'th bit of the string x Ci ; 

2. There exists a secure, non-interactive OT® n protocol; 

3. There exists a secure OT® n protocol; 

4. There exists a strategy for CHSH® n that succeeds with probability p. 

Note that in our equivalences, apart from translating the learning probabilities, we conserve the 
notions of security/non-signalling/hidden XOR through the reductions and we also deal with the 
interactivity and aborting of oblivious transfer protocols. 

In related work, Wolf and Wullschleger HWW051 showed that PR-Boxes, imaginary boxes 
that win the CHSH game with probability 1, are equivalent to perfect secure oblivious transfer. 
However, there is a timing issue as pointed out in ||BCU + Q5ll that makes the OT non-composable. 
Our results also extend these connections to the quantum world. 

1.5 Applications of the equivalences 

Our equivalences provide new ways of looking at quantum cryptographic primitives, quantum non- 
local games, and quantum encodings. They also allow for interesting, or even surprising, conse- 
quences. One reason is that we can use previous results in one area to prove bounds in another. 
For example, instead of proving a bound directly for oblivious transfer, one could use a bound for 
CHSH to obtain a bound for oblivious transfer. Take for example the semidefinite programs used 
to show perfect parallel repetition of XOR games HCSUU081 . These seem to have no connections 



with interactive oblivious transfer protocols, however they are intricately linked through our second 
equivalence result and therefore can be used to say something about oblivious transfer. 

Using Theorem [2] and the equivalences in Theorem [5] we have an alternative proof of the 
optimality of CHSH and an upper bound on CHSH n . We discuss the optimality of our bound on 
CHSH n in Appendix [Ql 

Corollary 1 (Bounds on CHSH and CHSH n ) For any n e N, w*(CHSH n ) < \ + -^ f . Fur- 
thermore, w*(CHSH) < cos~(7r/8), which is attainable by [CHSH69]. 

Moreover, we have the following bounds on secure oblivious transfer. 



Corollary 2 (Bounds on OT" and OT p ) For any n G N, the correctness of any secure OT™ 
protocol satisfies p < ^ + i n+1 - Furthermore, the correctness of any secure oblivious transfer 
protocol OT p must satisfy p < cos 2 (7r/8), which is attainable by MBBBW831 . 

Using perfect parallel repetition of CHSH HCSUU081 , we have the following corollary of The- 
orem [6] 

Corollary 3 (Perfect parallel repetition of oblivious transfer) For any n € N, the correctness 
of any secure OT® n protocol satisfies p < (cos 2 (7r/8)) n , which is attainable by using n instances 
of a secure OT COS 2 u /§\ protocol. That is, secure oblivious transfer admits perfect parallel repeti- 
tion. 

On the other hand, we get another variation of the hiding lemma when the XOR of Alice's two 
strings are hidden. 

Lemma 1 (Hidden XOR string lemma, version 2) Let {p xo ,x± : xq,xi} be a quantum encoding 
of two classical n-bit strings xq, x\ that are drawn from some known probability distribution. If 
the encoding reveals no information about xq © x\, then 



— 2_, Pr[learning x c ] < (cos 2 (-7r/8)) n 



2 

c6{0,l}" 

2 Cryptographic primitives and quantum game definitions 

We give formal definitions of the cryptographic primitives and quantum games used in this paper. 

Definition 1 (Imperfect oblivious transfer) A quantum oblivious transfer protocol with correct- 
ness p, denoted here as OT p , is an interactive protocol, with no inputs, between Alice and Bob 
such that: 

• Alice outputs two independent, uniformly random bits (zq,zi) or Abort and Bob outputs 
uniformly random bit b and another bit w or Abort. 



• If Alice and Bob are honest, w = z\, with probability p (for either value of b) and neither 
party aborts. 

• If p = 1 we say the protocol is perfect. 

We say that the oblivious transfer protocol has cheating probabilities ^4ot and Bqt where 

• Aot := Pr[Alice can learn b without Bob aborting], 

• Bot := Pr[Bob can learn zq © z\ without Alice aborting], 

• If Aot = 1/2 and Sot = 1/2 we say the protocol is secure. 

The choice to have the information as outputs instead of inputs is for convenience since Alice 
and Bob can always derandomize their outputs while retaining the same cheating probabilities 
(see HCKS13H for details). 

Definition 2 (Imperfect oblivious string transfer) A quantum oblivious string transfer protocol 
with correctness p, denoted here as OT™, with cheating probabilities ^4qt™ an d -Bot™, is defined 
analogously to an imperfect oblivious transfer protocol except zq and Z\ are n-bit strings. We say 
an OT" protocol is secure if Aqt" = 1/2 and Sqt" = 1/2", noting that Bob wishes to learn 
Zq © Z\. 

Definition 3 (n-fold repetition of oblivious transfer) A quantum n-fold repetition of oblivious 
transfer protocol with correctness p, denoted here as OT?" 1 , with cheating probabilities A OT ®„ 
and B OT ® n , is defined analogously to an imperfect oblivious string transfer protocol except b is 



-"55 n 
-P 

protocol is secure if A OT ®„ = l/2 n and B OT ®„ = 1/2", noting that Bob wishes to learn Zq ® Z\. 



an n-bit string (so Zf, takes values from each of Alice's strings according to b). We say an OT* 



Definition 4 (Imperfect coin flipping) A quantum coin flipping protocol with correctness p, de- 
noted here as CF p , is an interactive protocol, with no inputs, between Alice and Bob such that: 

• The protocol is aborted with probability 1 — p when Alice and Bob are honest. 

• If the protocol is not aborted, then they both output a randomly generated bit c. 
We say that the coin flipping protocol has cheating probabilities Aqf and Bqf where 

• Acf '■= m ax c6 { 0) i} PrfAlice can force Bob to accept outcome c], 

• Bqf '■= max ce{o,i} Pr[Bob can force Alice to accept outcome c]. 

Definition 5 (Bit commitment) A quantum bit commitment protocol, denoted here as BC, is an 
interactive protocol with no inputs, between Alice and Bob, with two phases: 

• Commit phase: Bob chooses a random b and interacts with Alice to commit to b. 



• Reveal phase: Alice and Bob interact to reveal b to Alice. 

• If the parties are honest, Alice accepts the value of b and neither party aborts. 

We say that the bit commitment protocol has cheating probabilities A^c an d B-qq where 

• .Bbc := Sfeelo 1} \ P r [B°b can force Alice to accept outcome b], 

• A-qc := Pr [Alice can learn b after commit phase]. 

Note that the roles of Alice and Bob are usually inverted, however this definition is more 
convenient for the analysis in this paper. 

Definition 6 (CHSH n game) The CHSH n game is a game between Alice and Bob where: 

• Alice and Bob are allowed to create and share an entangled state \tp) before the game starts. 
Once the game starts, there is no further communication between Alice and Bob. 

• Alice receives a random x G {0, l} n and Bob receives a random y G {0, 1}. 

• Alice outputs a G {0, l} n and Bob outputs b G {0, l} n . 

• Alice and Bob win ifcn®bi = y Xi, for all i G {1, . . . , n}. 

The value of the game, denoted here as u* (CHSH ra ), is the maximum probability which Alice and 
Bob can win. 

The CHSH game is the special case when n = 1 (we omit the subscript 1 in this case). 

Definition 7 (n-fold repetition of CHSH) An n-fold repetition o/CHSH, denoted here as CHSH® n , 
is a game between Alice and Bob where: 

• Alice and Bob are allowed to create and share an entangled state \tp) before the game starts. 
Once the game starts, there is no further communication between Alice and Bob. 

• Alice receives a random x G {0, l} n and Bob receives a random y G {0, l} n . 

• Alice outputs a G {0, l} n and Bob outputs b G {0, l} n . 

• Alice and Bob win if en © 6j = Xj yi, for alii G {1, . . . , n}. 

The value of the game, denoted here as oj* (CHSH® n ), is the maximum probability which Alice and 
Bob can win. 
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3 Learning and hiding lemmata 

3.1 Proofs of theorems 

In order to prove Theorem [Hand Theorem |2] we need the following claim about performing two 
projective measurements in sequence that could be of independent interest. 

Claim 1 Let \ip) be a pure state and {C, I — C} and {D, I — D} be two projective measurements 
such that 

cos 2 («) := ||C|^>||2 > i and cos 2 (/3) := \\D[yj)\\l> \- 

Then we have 

cos 2 (q - 0) > \\CD\il>)\\l + \\(I- C){I - D)\i>)\\l > cos 2 (a + /3). 
Proof We first prove the lower bound. Define the following states 



||(/-C)|^|| 2 " '• |W>|| 2 " '■ \\(I-D 

We have \ip) = cos(a)|X) + sm(a)\X') = cos(p)\Y) + sm(/3)\Y'). Since \X) is an eigen- 
vector of C, we can write C = \X){X\ +Ii-c an d similarly we can write I — C = \X'){X'\ +IIc", 
such that 

(U C ,\X)(X\) = (Uc>,\X)(X\) = (U C ,\X')(X'\) = (U CI ,\X')(X'\) = 0. 

We now write 

\Y)= 70 \X)+"f 1 \X'}+ l2 \Z) 

where |||Z)|| 2 = 1, (X\Z) = (X'\Z) = and |7o| = y/x®, |7i| = \/x\, and I72I = y^ for some 
xq, X\, X2 € [0, 1]. Using this expression for \Y), we have 



\\CD\^)\\i = cos 2 (/3) \\C\Y)\\^ = cos 2 (/3) (x Q + x 2 \\Uc\Z)\\ 2 

Since \ip) = cos(a)\X) + sm(a)\X') = cos(/3)|Y) + sm((3)\Y'), we can write 

\Y')= 1 ' \X)+ 7 ' 1 \X')+ 72 \Z) 

with J7q| = ■\fx 1 Q , l7il = V^a> an ^ 1 72 1 = \f x 2 f° r some x 'oi x '\i x 2 e [0, 1]. Using this expression 
for \Y'), we have 

||(1 - C)(l - DM\\l = sin 2 (/3) ||(1 - C)\Y')\\l = sm 2 (/3) (*i + x 2 ||n c ,|^>|| 2 ) • 
Notice that 

1 = \\c\z)\\l + \\(i- c)\z)\\l = \\ii c \z)\\l + ||n c ,|^>ll2 • 

11 



We define A := \\U C \Z)\\ 2 2 = 1- ||n C /|Z)|| 2 . This gives us 



\\CD\i>)\\i + \\(l-C)(l-D) 

cos 2 (/3) (x + x 2 \\U c \Z)\\i) + sm 2 (/3) (x[ + x' 2 ||n c ^)||^ 

cos 2 (/3) (o: + x 2 ,4) + sin 2 (/3) (xi + x' 2 (l - A)) 

cos 2 (/3)x + sin 2 (/3) (x' x + x' 2 ) + A (cos 2 (/3)x 2 - sin 2 (/3)x' 2 ) 

2 (/3)x + sin 2 (/3) (1 - x' ) + ^ (cos 2 (/3)x 2 - sin 2 (/3)x' 2 ) . (1) 



cos 



Define A(p,a) := aiccosF(p,a) to be the angle between two states p and a, which is a metric 
(see p. 413 in INCOOl "). Since (Y\Y') = 0, we have 

A(\Y'),\X))>n/2-A(\X),\Y)). 

This implies that 

c = cos (arccos |(F'|X)|) < cos (tt/2 — arccos t/xq) = sin (arccos y/x~o) = vl — xo. 
This yields x' < 1 — xo- Also, notice that (ip\Z} = 0, which implies that 

{Z\(cos(P)\Y)+sm(l3)\Y')) =0 

^ cos 2 (/3)|(Z|y)| 2 = sm 2 (/3)|(Z|y')| 2 
•^=>- cos 2 (/3)x 2 = sin 2 (/3)x 2 . 



This gives us the bound 



CD\,l>)\\l + \\0.-C)(l-D)\fl>)\\l>x o . (2) 



To conclude, we have 



arccos(V^) = A(\X), \Y)) < A(\X), |^» + A(|V>>, |^)) <« + /?, 

yielding xo > cos 2 (a + /3) which concludes the proof of the lower bound. 

For the upper bound, we have x' < 1 — xo and cos 2 (/3)x 2 = sin 2 (/3)x 2 , hence, 

\\CD\i;)\\l + \\(l-C)(l-D)\4,}\\l<l-x' , 

from CQ). We now show 1 — x' < cos 2 (/3 — a). Since y^o = |(y'|-X")|, we have 

arccos 

so 

a/Xq > cos(7r/2 — (f3 — a)) = sin(/3 — a) ==> 1 — x' < cos (J3 — a), 

as desired. D 
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x' = A(|y'), |X» < A(|X), |^» + A(\Y'), \i>)) = tt/2 -(/?-«). 



Proof of Theorem [T] The proof of the first statement in the theorem relies on the following decod- 
ing strategy: First, we apply the decoding procedure for learning the first bit and then we apply the 
second decoding procedure on the post-measurement state. The probability of decoding the XOR 
is the probability that both decoding procedures succeed or they both fail. 

We prove the theorem using the following (equivalent) setting. We suppose two parties, Al- 
ice and Bob, share a joint pure state \Q)ab such that Alice performs a projective measurement 
M = {M XOjXl } XoXie {Qiy on A to determine xq and x\ and the post-measured state is Bob's en- 
coding of xo and x±. Let pi be the maximum probability that Bob can leam bit Xi, for i G {0, 1}. 
We note that without loss of generality, Bob can perform a projective measurement to guess the 
value of X{ with maximum probability HNC0011 . Let P = {Pq, P{\ be Bob's projective measure- 
ment that allows him to guess xq with probability po = cos 2 (a) > \ and Q = {Qo, Qi} be Bob's 
projective measurement that allows him to guess x\ with probability p\ = cos 2 (/3) > \ (these 
measurements are on B only). Consider the following projections (on A <§) £>): 

C = J2 M zo,*i ® Px and D= Yl Mx o> x i ® Q*i- 

xo.xi a;o,a;i 

C (resp. D) is the projection on the subspace where Bob guesses correctly xq (resp. x\) after 
applying P (resp. Q). Consider the strategy where Bob applies the two measurements P and Q 
one after the other to learn (xo,^i), from which he can calculate xq © x\. If both guesses are 
correct or if both guesses are incorrect then his guess for xq © x\ is correct. 
Let Bob perform the following projective measurement to learn both bits 

The measurement where Bob guesses both bits correctly when applying R is 

E = J2 M ^x! ® R X0)X1 = DCD 

XQ,X1 

with outcome probability (Q,\E\Q) = \\CD\Q)\\ 2 . The measurement where Bob guesses both bits 
incorrectly when applying R is 

F=Y, M -o,*i ® Rzofr =(I-D)(I- C)(I - D) 

X ,X\ 

with outcome probability (Q.\F\VL) = \\(I - C)(I - D)\Q)\\l. With this strategy, Bob can guess 
xq © xi with probability 

||C J D|0)|| 2 + ||(/-C)(/- J D)|^)|| 2 >cos 2 (a + /3) 

by Claim [U Note that 

._ Po+Pi _ cos 2 (a) +cos 2 (/3) 1 
C '~ 2 ~ 2 ~ 2 
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and by Claim[3](in Appendix©, we have cos(a + /3) > cos 2 (a) + cos 2 (/3) — 1. From this, we 
conclude that 

Pr[Bob can learn x © x\\ > cos 2 (a + /3) > (2c - l) 2 . 

For the second statement, ideally, we would like to extend our proof approach from bits to 
strings, but unfortunately this statement is not true anymore if xq and x\ are strings. Instead, the 
analysis in MCKS13H can be generalized to strings to show 

^ r, . m /cos 2 (a) + cos 2 (/3)\ 9/ 

Pr [learning (x ,xi)] > ^-r — cos 2 (a + /3). 



If c > 1/2, then by Claim|3](in Appendix©, we have Prflearning (xo,xi)] > c(2c — l) 2 . The 
statement about the XOR follows directly from the above statement. □ 

Proof of Theorem |2] By rearranging the XOR learning lemma for bits, we have 

- Pr [learning xq] -\ — Pr [learning xi] < — | — yPr [learning xq © x\\. 

Setting Prflearning xq © x\] = 1/2 yields the first statement of the theorem. 

For the string version, we know that if the encoding reveals no information about xq ffi x±, 
then Pr[learning xq © x\] = ^. If c := \ Pr[learning xq] + ^ Prflearning x\] < 1/2, the theorem 
statement is clearly true. If c > 1/2, we get Pr[Bob guesses xoffixi] > c(2c— l) 2 from TheoremQ] 
This yields 

— = Pr [learning x © x x ] > c(2c - l) 2 > -(2c - l) 2 

Z n 2 

which implies c < | + r^+i , as desired. D 

Note that this bound for strings is not tight. In particular, for n = 1, this bound gives us c < 1 
instead of cos 2 (7r/8) ~ 0.854. However, the probability goes exponentially fast to 1/2 as n grows. 

3.2 Applications 

Using Theorem Q] and Theorem |2j we prove some new lower bounds for oblivious transfer. We 
first prove Theorem [3] by showing how to construct an imperfect coin flipping protocol from an 
imperfect oblivious transfer protocol. 

Protocol 1 (CF p from OT p ) 

1. Alice and Bob perform the OT p protocol so they have outputs (zq, z\) and (b, w) respectively. 

2. If no one aborted, then Alice sends randomly chosen d Er {0, 1} to Bob. 

3. Bob sends b and w to Alice. 
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4. If Zb from Bob is inconsistent with Alice's bits then Alice aborts. Otherwise, they both output 

c = b®d. 

We see that this is a CF P protocol since when both players are honest, there is a 1 — p chance 
of aborting (from Alice's side), and otherwise the outcome is random. 

Using our XOR learning lemma for bits, and an analysis similar to the one in HCKS13I . we can 
show that 

,4ot = -4cf and ^ > B C f- 

Kitaev's lower bound for coin flipping [Kit03] states that 

^cf^cf > Pr [Alice and Bob honestly output 0]. 

In the case of imperfect coin flipping, we have that Alice and Bob both output either bit with 
probability p/2 (since the protocol is aborted with probability 1 — p). Therefore, we have 



-4ot 2 ^cf-Bcf > 2 => -4ot ( V b ot + lj > P, 

proving Theorem [3] 

In Appendix HH we construct a bit commitment protocol from an oblivious transfer protocol 
and by our XOR learning lemmata and the bit commitment lower bounds in MCK11II we prove the 
stronger lower bounds in Theorem @] 

4 Equivalences of secure oblivious transfer and CHSH 

We give four reductions in order to prove Theorem |5] the reductions to prove Theorem [6] fol- 
low similarly. We show the reduction from hidden XOR to secure, non-interactive oblivious 
string transfer (1. =^> 2.); from secure, non-interactive oblivious string transfer to CHSH n 
strategies (2. =^> 4.); from secure oblivious string transfer to hidden XOR (3. ==> 1.); 
and from CHSH n to hidden XOR (4. =^> 1.). Since (2. ==> 3.) is obvious, we have 
(1. =^ 2. ^=^> 3., 4. =^ 1.) allowing us to conclude all four statements are equivalent. 

Hidden XOR to secure, non-interactive OTp (1. => 2.): Let {p Xo ,xi '■ x ,xi £ {0, l} n } 
be a set of quantum states and {7r X0iXl : xq, x\ E {0, 1}™} be a probability distribution satisfying 
the properties of statement 1 of Theorem|5] Alice chooses xo, x\ with probability n XOrXl and sends 
Px Q ,xi to Bob. Alice outputs 

(zq, z\) := ((1 - a)x + ax\ + di, (1 — a)x\ + ax + d 2 ) 

where a is a randomly chosen bit and di,d 2 are independent randomly chosen bit strings. She 
sends a, d\, d 2 to Bob. The first bit randomizes the success probabilities for Bob (so he has an 
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equal chance of learning zq as for z\) and the d\,d,2 bit strings ensure that Alice's outcomes are 
random. Bob picks a uniformly random bit b and measures to learn Zb depending on a, d±, cfo from 
Alice. In particular, we have 

Pr[Bob learns Zb] = - Pr[Bob leams Zb\a = 0] -\ — Pr[Bob learns zi\a = 1] 

= - Pr[Bob leams xq] -\ — Pr[Bob learns x±] 

= P, 

for b G {0, 1}. Note that zq © z\ = xq © x\ © d\ © ofo is hidden from Bob and Alice cannot learn 
b, thus this protocol is secure. 

Secure, non-interactive OT£ to CHSH n strategies (2. =>• 4.): Suppose there is a secure, 
non-interactive OT™ protocol with correctness p. Without loss of generalityo Alice and Bob share 
the following classical-quantum state 

5Z 7p^\ z 0,Zl){Z0,Zl\®Pz , Zl , 

zo,zi€{0,l} n 

for some quantum states p Zo ,zi that are in Bob's private space B. Since Alice has no information 
about b, the state sent by her is independent of b, hence Bob can use this state to decode either 
of Alice's strings. Let {M® } zoe mi\n be Bob's measurement to learn Alice's first string and let 
{M^} z l£ {o,i}« be his measurement to learn Alice's second string. Since Bob can learn Alice's 
string with probability p, we have 

p = Pr[Bob learns z }= £ -l(M^,p Z0)Z1 ) (3) 

zo,2ie{o,i} n 

p = Pr [Bob learns Zl ] = ^ ^(M 1 ^, Pzo , zl ). (4) 

zo,zi6{0,l} n 

Now consider any purifications \ipzo,zi) £ ■A. © B of p ZOiZl where A is a space controlled by 
Alice. Let us define 

1°) := Y^ 2^\ z O® z l)Ai\zo)A a \zi)Aa\lf>zo,zi)M3, 

z ,zie{0,i} n 

\Q X ) to be the post-measured state assuming Alice measured A\ to get x, and let Bob's reduced 
state on B be p x := Tr v 4 2 _4 3 _4|0 3; )(0 : j.|. We have that p x = po f° r a U % £ {0, l} n since Bob has no 
information about zq © z\. By Uhlmann's theorem, we have that for all x G {0, l} n , there exists 
a unitaiy C/ a . acting on A2 © A?, © .4 such that (C/ x © iB)|fi x ) = l^o)- We can now define the 
strategy for Alice and Bob to win the CHSH n game with probability p: 



2 For our purposes, we can assume Alice discards her quantum state except for the registers containing her values for 

zq and z\ . 
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• Alice and Bob share the state |Oo) an d receive random x G {0, l} n and y G {0, 1}, respec- 
tively. 

• Alice applies (U x )^ such that Alice and Bob share the state \Q X ). She measures the space 
Ai in the computational basis to get her outcome a. 

• Bob applies the measurement {-M^}&g{o,i} n on his space B to determine his outcome b. 

We now analyze this strategy. Conditioned on Alice receiving x and outputting a, Bob has the state 
Tr.4 1 4> a ,x(Ba} (i>a,x(Ba I = Pa,x®a- If Bob g ets V = 0, he must output b = a. If Bob gets y = 1, he 
must output b = a © x. The probability they win the CHSH„ game with this strategy is 



1 1 

- Pr[Bob learns a] -\ — Pr[Bob learns x © a] 

O Z_> 2M(M a ,Pa,x®a) + r ^ 22^(Mx®aiPa,x®a) 



x,ae{0,l} n x,a&{0,l} 

= P, 

from Equations © and (HJ). 

Secure, interactive OTp to hidden XOR (3. =^~ 1.): Let |ri)_4g be the final joint state of 
the interactive OT™ protocol when Alice and Bob are honest. Suppose Alice measures to learn 
(zo,zi) which are both distributed uniformly. Let p Zo ,z\ be Bob's post-measured state. We now 
argue {p Zo ,zi '■ ^Oi^i} an(1 n being the uniform probability distribution satisfy the hidden XOR 
condition. Since Alice does not abort because both parties have been honest, and the protocol is 
secure, we know the XOR is hidden from Bob. It now suffices to describe a decoding procedure to 
learn each z c , for c G {0,1}, with probability p. 

We may assume Bob measures his part of the state |fi)_4g (instead of decoding /0 Z0)2l ) since it 
does not matter if Alice measures before or after Bob. Suppose |^)^4b is the post-measured joint 
state when Bob partially measures |fi)_4B to obtain his index b. Since Bob will not abort at this 
stage and the protocol is secure, we know b is hidden from Alice. Again, by Uhlmann's theorem, 
we know that Bob can transform \Qq) to \Qi) and vice versa via a unitary acting on B. Hence Bob 
can measure |f2)„4B to learn b and collapse the state to |fi&) and then apply the unitary mapping 
|f2fc) to |O c ). He then uses the decoding procedure of the OTp protocol to learn z c with probability 
p. 

CHSH n strategies to hidden XOR (4. =^ 1.): Let l^)^ be the state that Alice and Bob 
share before receiving x and y in a CHSH n game strategy that succeeds with probability p. Suppose 
Alice measures to learn a (conditioned on x). Let p a ^ x be Bob's post-measured state which occurs 
with probability TT a ,x- We define the necessary states and probabilities by relabelling a — > xq and 
x © a — >• x\. Then, Bob has no information about xq © xi = a © (x © a) = x from non-signalling, 
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and 

- Pr[Bob learns xq] + - Pr[Bob learns x\] = - Pr[Bob learns a] + — Pr[Bob learns x © a] = p. 

This concludes the proof of Theorem [5] 

4.1 Applications of equivalences 

As we have discussed in the introduction, our equivalences allow us to use results from one area to 
prove new results in another area. More specifically, using our Hidden XOR lemmata, we provide 
an alternative proof of the optimality of CHSH and an upper bound on CHSH n (Corollary [Q 
and similar bounds for oblivious transfer (Corollary |2). In addition, using known results about 
the CHSH game, we prove an alternative Hidden XOR lemma for n pairs of bits and a parallel 
repetition result for secure oblivious transfer (Lemma [T]and Corollary |3). 
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A Bounds on the complementarity of measurements 

Let us assume for a quantum state \ip) and two measurements {C, I—C} and {D, I—D}, that mea- 
suring the state \ip) with the measurement {C, I — C} yields the "correct" outcome C with proba- 
bility cos 2 (a) and the "wrong" outcome I — C with probability sin 2 (a); and similarly, measuring 
the state \ip) with the measurement {D, I — D} yields the "correct" outcome D with probability 
cos 2 (/3) and the "wrong" outcome I — D with probability sin 2 (/3). 

We would like to study how the effect of performing the first measurement changes the infor- 
mation we can extract through the second measurement. Two measurements are perfectly comple- 
mentary, if after having performed the first measurement, no more information can be extracted 
by performing the second measurement on the measured state. On the other hand, they are non 
complementary if after measuring with one, the probabilities of the outcomes of the second are 
unaffected (which is the case for classical measurements). 

We provide a quantitative analysis for the case where the information is correctly decoded when 
both measurements output the correct outcome or both output the wrong outcome (as for example, 
in the case of trying to learn the XOR of two bits by decoding one after the other). Let us define F 
as the following measure 

r = ncj^i-^Mil -k |K^ — -c^c^ — j^)|^>||1 — ||C|^>lll ||J^|^>lll — IK^ — c)|-^>lll IK-r — ^^)|-^>Ml - 

In the case of non complementary measurements, T = 0. By Claim[Q we have 

|r| < -sin(2/3)sin(2a). (5) 

Note that F can take both positive and negative values, since the act of performing the second mea- 
surement on the post-measured state can increase or decrease the probability of correctly decoding. 
The inequality © can be tight, since when C = D, we have F = | sin(2/3) sin(2a) and when 
C = I-D,we have F = -\ sin(2/3) sin(2a). 

B Lower bounds on the security of perfect oblivious transfers 

We now define a bit commitment protocol where the commit phase is a perfect oblivious transfer 
protocol and the reveal phase is classical. 

Protocol 2 (Bit commitment from oblivious string transfer BCKS13II ) 

1. Commit phase: Alice and Bob perform the OT™ protocol such that Alice gets the output 
Oo, z\) G {0, l} n x {0, l} n and Bob gets the output (b, w) G {0, 1} x {0, l} n . Here, b is 
the committed bit. 

2. Reveal phase: If no one aborted, then Bob sends (b, w) to Alice. 
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3. If (b, w)from Bob is inconsistent with (zq, z\) then Alice aborts. Otherwise, she accepts b as 
the committed bit. 

We have ^ot" = ^4bc since both are equal to the amount Alice can learn b from the OT™ pro- 
tocol without Bob aborting. It is clear that Bob must send (c, z c ) if he wants to reveal c. Therefore, 
by letting q be the probability the OT™ is not aborted by Alice using Bob's optimal bit commitment 
strategy, we have B B c = Qc, where 

c = - 2, Pr[Bob can learn zj,\ Alice did not abort the OT™ protocol]. 

fee{o,i} 

From Theorem [Q we know that Bob has a strategy to learn (zo, z\) with probability 

B OT n > qc (2c - l) 2 
noting that B BC > 1/2 => c > 1/2. 

Fact 1 (Lower bound for bit commitment ICK11II ) For any bit commitment protocol, there is a 

parameter t G [0, 1] such that 

Sbc > f 1 - f 1 - -4) *J and A BC >\ + \- 

Using Fact[Q this yields the lower bound max{^4oT™) ^ot™} > 0.5852, which is independent of 
n. If n = 1, we can use the stronger bound in Theorem [T]to get 

Bot > q(2c - l) 2 

improving the lower bound to max{AoT, -Sot} > 0.599. 



C Technical Claims 

Proof Without loss of generality, suppose that 9 > r. Consider the function 

f(9) = cos{9 + t) - cos 2 (^) - cos 2 (r) + 1 



Claim 2 Suppose 9,t £ [0, n/2] satisfy 9 + r < n/2. Then cos(9 + r) > cos 2 (9) + cos 2 (r^ 



for fixed r. Taking its derivative, we get f'(9) = — sin(0 + r) + sm(28), which is nonnegative for 
9 G [r, vr/3 - r/3] and nonpositive for 9 G [it/3 - r/3, vr/2 - r]. Note that r < vr/3 - r/3 < 
7r/2 — r since r < 7r/4. So we conclude that / is increasing on [r, n/3 — r/3] and decreasing 
on [7r/3 — t/3,7t/2 — r]. Since /(r) = and /(vr/2 — r) = 0, we have that / is positive 
for 9 G [t, 7t/2 - t]. If 0,r G [0,tt/2] with 9 + r < 7r/2 and 6» > r, we have exactly that 
G [r, 7r/2 — t]. We conclude from the positivity of / that cos(9 + r) > cos 2 (9) + cos 2 (r) — 1, 
as desired. □ 
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Claim 3 Let6,r G [0, § ] satisfy cos 2 (6) + cos 2 (t) > 1. Thencos(6 + T) > cos 2 (0) + cos 2 (r)- 1. 
Proof Since f?,r G [0, 7r/2] satisfy cos 2 (6 l ) + cos 2 (r) > 1, we have 

cos 2 (fl) + sm 2 (#) = 1 < cos 2 (6) + cos 2 (r) = cos 2 (6) + sin 2 (7r/2 - r) 
which gives directly 6 < tt/2 — t, or equivalently, 9 + r < 7r/2. Claim[2]concludes the proof. □ 

D Bounding the value of CHSH n using semidefinite programming 

We discuss the tightness of our bound on CHSH n , i.e., that 

W *(CHSH n )<i + ^=L=. 

2 y/2 n + l 

This was proven using an equivalence to a Hidden XOR condition and subsequently by our Hidden 
XOR lemma. However, this is not the only way to bound the value of quantum games. For in- 
stance, one can upper bound the value of two-player, one-round games using semidefinite program- 
ming MKRT10H . We now compare our bound to the one given by semidefinite programs (SDPs). 

We solved a relaxation^ of this SDP to get numerical upper bounds on the value of CHSH n for 
n G {1, 2, 3, 4, 5}. These values can be found in Table Q] along with the values from our proven 
upper bound and the classical value lower bound. 

Table 1: Bounds on the CHSH n game for n G {1, 2, 3, 4, 5}. 



Value 


n = 1 


n = 2 


n = 3 


n = 4 


n = 5 


Classical Value 


0.7500 


0.6250 


0.5625 


0.5312 


0.5156 


Conjectured Value 


0.8535 


0.7500 


0.6767 


0.6250 


0.5883 


SDP Relaxation 


0.8535 


0.7803 


0.7437 


0.7254 


0.7163 


Our Proven Bound 


1 


0.8535 


0.7500 


0.6767 


0.6250 



We can see that the SDP relaxation gives a tighter upper bound than ours for n < 3, but the 
numerical results suggest that our bound outperforms the SDP bound for larger values of n. This 
implies that neither our bound nor the SDP one can be optimal for all n. In fact, we have the 
following conjecture for the optimal value. 



Conjecture 1 For every n G N, the value o/CHSH n is w*(CHSH n ) = \ + 



This provides the correct value for n = 1 and is a stronger bound for all n. It remains open to 
show whether our conjectured value is a lower and/or an upper bound on the value of CHSH n . 



3 This relaxation is faster to solve and gives the same numerical values as solving the semidefinite program for small 
values of n. 
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